ci: dogfood the Modelpin Action (self-consistency check)

.github/workflows/modelpin.yml

@@ -0,0 +1,40 @@
+# Modelpin dogfooding itself — an on-demand self-consistency smoke that exercises the GitHub
+# Action end-to-end (install -> mp check -> status check). It replays gpt-4o-mini against its own
+# committed baseline; a green run means the engine isn't crying wolf on normal model
+# nondeterminism (the false-positive north-star). Uses the LOCAL action (`uses: ./`) + installs
+# the LOCAL package (`modelpin-spec: ".[providers]"`), so it validates the action.yml + engine
+# as they are in the repo — no published tag required.
+#
+# MANUAL ONLY (workflow_dispatch): modelpin isn't itself an LLM app, so we don't run a
+# model-check on every PR (it'd spend API calls for little signal). The full PR-comment flow was
+# validated live on PR #2. The recommended *per-PR* pattern for a real app — on: pull_request,
+# with the sticky comment + fail-on-regression — is in examples/github-workflow.yml.
+#
+# Needs ONE repo secret: OPENAI_API_KEY (Settings -> Secrets and variables -> Actions).
+# Run it from the Actions tab ("Run workflow") or: gh workflow run modelpin.yml.
+
+name: Modelpin
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write        # lets the action comment when run in a PR context
+
+jobs:
+  model-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Modelpin behavioral check
+        uses: ./                          # the action in this repo (root action.yml)
+        with:
+          from: gpt-4o-mini               # committed baseline: .modelpin/baseline-gpt-4o-mini.json
+          to: gpt-4o-mini                 # re-check the same model -> expect "unchanged"
+          provider: openai
+          config: modelpin.yaml
+          runs: "5"
+          modelpin-spec: ".[providers]"   # install this repo's code (pre-tag dogfood)
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

.gitignore

@@ -13,8 +13,11 @@ venv/
 .DS_Store
 *.log
 
-# Local Modelpin state (recorded baselines + last rendered report)
-.modelpin/
+# Local Modelpin state: ignore transient outputs (rendered report, temp files) but ALLOW
+# committing recorded baselines — the migration flow commits the known-good baseline so CI
+# can diff a candidate model against it. (Re-include needs `.modelpin/*`, not `.modelpin/`.)
+.modelpin/*
+!.modelpin/baseline-*.json
 
 # Ad-hoc calibration re-run scratch output (committed evidence snapshots live in
 # examples/calibration/results/ instead — see that dir + docs/STATUS.md).